A New Approach of Botnet Activity Detection Model based on Time Periodic Analysis
Dandy Pramana Hostiadi, Tohari Ahmad, Waskitho Wibisono · 2020
Botnet is a serious and dangerous threat in a computer system. Bot infect a new computer to form bot network and produce an activity track record. Several previous studies have introduced a bot activity detection model by analyzing network flows traffic and performing static time segmentation. Inaccurate segmentation timing can eliminate bot activity chain and affect detection accuracy. This paper proposed a bot activity detection model by performing time segmentation using segment transition analysis. The proposed model identified multi-stage, analyzed the central node activity, and measured the similarity of the indicated activities in each segment. Last, the proposed model performs a chain trace to detect bot activity. Our goal is to perform an accurate detection of bot activity and tracking bot activity's communication chain by segment transition analysis. The results show that the proposed model can detect bot activity and bot activity's communication chain well with an accuracy of 97.93%.